Traefik is a very robust reverse proxy, but I think you have easier options. If you want to keep it all in the same stack, have a look at Caddy. The configuration is just a few lines. Another very good option since you’re already using pfSense would be to use the HAProxy plugin. You’ll get a UI to manage everything and Tom Lawrence has some very helpful videos about setting it up from start to finish.
I like both very much for what they are and would confirm that Caddy is a lot easier for beginners. The only downside is that you have to rebuild the binary with caddyx for more functionality which can be limiting e.g. for people wanting to start with dns challenges for (wildcard) certificates.
Um... The "barebones" docker compose doesn't use TLS. How did you try to access the web UI?
Do you have your browser set to HTTPS-only by any chance?
I used this guide to use traefik with a wildcard certificate from let's encrypt that is internal only. So I have
Immich.domain.com
And also
Vault.local.domain.com
This allows something like vaultwarden to only be accessible on my internal LAN while something like immich is exposed so I can share albums with anyone I want.
If I want to connect to vaultwarden while away from home, I connect to wireguard first then access via the local URL.
In docker I don't even close the app's ports, so even locally everything has SSL everywhere.
Regarding the spinning wheel If accessed with a browser over http you never get through but the clients on desktop and mobile worked with http. At least until a few weeks ago. That forced me to get it working with a reverse proxy. Neither traefik nor npm did the trick and now I have a beautiful pangolin instance running on my vps. That software is amazing so far.
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.